Critical Elementor Pro Flaw Enables Unauthenticated RCE

A critical vulnerability, CVE-2026-32475 (CVSS 9.0), has been discovered in the Elementor Pro WordPress plugin's Forms module. This flaw allows unauthenticated attackers to bypass extension validation and upload arbitrary PHP files, leading to full server compromise and remote code execution (RCE). The vulnerability stems from a logic error in how the plugin processes file uploads in separate loops, which can be manipulated by submitting multi-part file requests.

Additionally, a secondary risk involves CVE-2026-65640 (CVSS 8.8) in WordPress core, which allows Author-level users to achieve RCE via malicious PostScript uploads if Imagick and Ghostscript are present. While there is no confirmed active exploitation of the Elementor Pro flaw at this time, the high ease of exploitation and widespread use of the plugin across millions of websites make this a high-priority threat.

Successful exploitation could result in the installation of persistent webshells, exfiltration of sensitive data, and lateral movement within hosting environments. Organization should prioritize patching Elementor Pro to version 4.2.2 and WordPress core to 7.0.4 immediately.